openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect

[default_sect]
activate = 1

[pkcs11_sect]
module = /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
pkcs11-module-path = /usr/lib/libIDPrimePKCS11.so
pkcs11-module-token-pin = 12345687    # zde nastav spravny PIN
pkcs11-module-load-behavior = early
pkcs11-module-login-behavior = always
pkcs11-module-cache-pins = cache
activate = 1
pkcs11-module-allow-export = 0

[eml_sign]
# Tady vloz URL certifikatu na konci musi byt "type=cert" - normalne to prepis
cert_uri = pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=8E2599EE8E46FCB4;token=8E2599EE8E46FCB4%20%28Digital%20Signat;id=%69%53%69%67%6E%75%6D%20%32%30%32%35%31%30%30%33%2D%30%39%32%39%32%34;object=iSignum%2020251003-092924;type=cert
# Tady vloz URL certifikatu na konci musi byt "type=private" - to uz tam asi mas
key_uri = pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;serial=8E2599EE8E46FCB4;token=8E2599EE8E46FCB4%20%28Digital%20Signat;id=%69%53%69%67%6E%75%6D%20%32%30%32%35%31%30%30%33%2D%30%39%32%39%32%34;object=iSignum%2020251003-092924;type=private
# Tady vloz MEZILEHLY (ne KORENOVY) certifat PostSignum (nebo jine certifikacni autority)
# Když soubor neexistuje, skript podepíše jen signer certifikátem a tento mezilehly se nevlozi
chain_pem = publicKeys/PostSignum_QCA4.pem